Red-team tooling that plugs into Claude Code, no API key required

What it does

pentest-ai is an offensive-security framework that exposes 205 real security tools and 60 SPA-aware web probes through an MCP server. You point it at a target from inside Claude Code, Cursor, or another MCP client, and it runs reconnaissance, chains findings into multi-step attack paths, and outputs working proof-of-concepts with audit-ready reports. If you don’t use an MCP client, a standalone CLI mode lets you bring your own LLM and runs fully offline.

The interesting bit

The project is unusually honest about its limitations: it publishes a 63.24% catch rate against OWASP Juice Shop but openly admits that score is inflated because Juice Shop is a deliberately vulnerable, heavily documented training app. To balance the marketing, it also runs a private honeypot in CI with bugs it wrote itself and publishes those lower numbers too.

Key highlights

• 205 wrapped tools (sqlmap, ffuf, dalfox, etc.) and 60 SPA-aware probes covering OWASP Top 10 bug classes, all reachable via 49 MCP tools.
• No extra API key needed on the MCP path: it piggybacks on an existing Claude Pro/Max/Team, Cursor, or Copilot subscription.
• Standalone CLI includes a $10 USD spend cap by default and supports Ollama for air-gapped runs.
• Safety rails exist but default to off: intensity=safe, respect_rate_limits, and strict_scope must be opted into.
• Mid-run human-in-the-loop: double-tapping Ctrl+C pauses the orchestrator and drops into a REPL to inspect or steer the engagement.

Caveats

• The 60 web probes are limited against novel targets; the README explicitly warns that catch rates outside known-vulnerable apps depend on what the curated library actually covers.
• Safety features that prevent mutating server state or following off-scope redirects are opt-in, not the default, so careless use can damage production targets.
• The standalone agent loop burns real money; the $10 cap is a backstop, not a guarantee against runaway costs.

Verdict

Bug-bounty hunters and red-teamers who already live inside Claude Code or Cursor should look at this as a force multiplier for their existing workflow. If you need a fully passive, zero-config scanner or are uncomfortable managing LLM spend caps, this is not your tool.